CVE-2026-105875 in Prime Slider Addons Plugin
Summary
by MITRE • 10/07/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects Prime Slider – Addons For Elementor: from n/a through 4.6.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The identified security flaw represents a classic instance of Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or XSS. Specifically, this vulnerability is classified under the CWE-79 standard within the Common Weakness Enumeration framework, which details weaknesses related to the injection of client-side scripts into web pages viewed by other users. In the context of the BdThemes Prime Slider – Addons For Elementor plugin for WordPress versions ranging from n/a through 4.6.2, this flaw manifests as a Stored XSS vulnerability. Unlike reflected XSS attacks where malicious payloads are delivered via URLs and require immediate user interaction to trigger, stored vulnerabilities persist on the target server. This means that once an attacker successfully injects their malicious script into the application's data store, it is permanently saved and subsequently served to every victim who views the affected content, significantly amplifying the potential impact of the exploit.
The technical root cause lies in the insufficient sanitization or validation of user-supplied input before it is rendered within HTML responses by the plugin. When an administrator or a user with sufficient privileges inputs data into fields managed by Prime Slider – Addons For Elementor, such as slide titles, descriptions, or custom attributes, the application fails to properly encode special characters that have semantic meaning in HTML and JavaScript contexts. Consequently, when this untrusted input is retrieved from the database and displayed on the frontend of a WordPress site, it is interpreted not as plain text but as executable code by the victim's web browser. This failure allows an attacker to inject arbitrary JavaScript code into the page context, effectively hijacking the execution environment of legitimate users visiting the compromised website.
From an operational perspective, this vulnerability poses severe risks to both end-users and site administrators. The primary impact involves the compromise of user sessions and credentials. An attacker can utilize techniques such as cookie stealing or session hijacking to impersonate authenticated users, potentially gaining unauthorized access to administrative functions if a victim with elevated privileges views the malicious content. Furthermore, attackers may deploy phishing pages that mimic legitimate login forms to harvest sensitive information like usernames and passwords. Beyond credential theft, this vulnerability enables defacement of the website's appearance, redirection of traffic to malicious domains hosting malware or ransomware, and the execution of drive-by downloads on client machines depending on browser vulnerabilities. The persistent nature of stored XSS means a single successful injection can compromise numerous users over an extended period without further effort from the attacker.
In terms of threat modeling and adversary behavior, this vulnerability aligns with MITRE ATT&CK techniques related to Client-Side Scripting Injection. Attackers typically exploit such flaws during the initial access or persistence phases of an attack chain. By embedding malicious scripts in content that is likely to be viewed by high-privilege users, attackers increase their chances of achieving persistent control over the environment. The lack of immediate detection mechanisms for stored XSS makes it particularly dangerous, as the malicious code remains active until manually removed from the database or the plugin itself is updated and patched.
To mitigate this vulnerability, site administrators must immediately update the BdThemes Prime Slider – Addons For Elementor plugin to version 4.6.3 or later, where the input handling logic has been corrected to properly sanitize outputs. Until an official patch is applied in environments where updating is not immediately feasible, temporary mitigations should be considered. These include implementing a Web Application Firewall that can detect and block common XSS payloads based on signature patterns, although this is not a substitute for proper code-level fixes. Additionally, enforcing strict Content Security Policy headers can help mitigate the impact by restricting the sources from which scripts are allowed to execute, thereby preventing injected scripts from running even if they are successfully embedded in the page source. Regular security audits and input validation practices should be integrated into the development lifecycle to prevent similar issues in future releases.